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IN THE CLAIMS 

Please amend the claims as follows: 

1 - 48. (canceled) 

49. (currently amended) An apparatus comprising: 
a processor; and 

a storage device connected to the processor, wherein the storage device has stored 
thereon a program, wherein the processor is configured o perative t o execute instructions 
of the program to implement a method comprising the steps of: 

updating, at successive update times, virus definitions for resources stored 
on a data processing system; 

scanning the resources for viruses in first and second scanning instances 
responsive to the virus definitions updated at respective first and second ones of 
the update times; 

computing hash values for the resources at the first and second update 

times; 

classifying each of the resources as higher or lower priority responsive to 
whether the hash values for each resource are equal for the first and second update 
times and whether the scanning determines each resource is virus free in both the 
first and second scanning instances; 
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j determining a scanning interval from a time of the first scanning instance until a 

time of the second scanning instance; 

updating the virus definitions at a next update time; and 

scanning resources for viruses in a next scanning instance responsive to the 
virus definitions updated at the next time, wherein in the next scanning instance 
the ones of the resources classified as higher priority are scanned before the onc3 
of the resources classified as lower - priorit y and the scanning of the higher priority 
resources in the next instance includes scanning i) resources determined to be virus 
free in both the first scanning instance and the second scanning instance but not 
having equal hash values in the first and second update times, ii) resources 
determined to be virus free in both the first scanning instance and the second 
scanning instance and having equal hash values in the first and second update 
times but wherein the scanning interval is less than a predetermined threshold, in) 
resources determined to be virus free in the first scanning instance and having 
equal hash values in the first and second update times but wherein the scanning 
interval is less than a predetermined threshold, and iv) resources determined to be 
virus free in the second scanning instance but wherein the scanning interval is less 
than a predetermined threshold . 

50. (previously presented) The apparatus of claim 49, wherein the data processing 
system has activity intervals of higher and lower activity and in the next scanning instance 
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the scanning of the ones of the resources classified as lower priority is performed during 
one of the lower activity intervals. 

51. (canceled) 

52. (previously presented) The apparatus of claim 49, wherein in the next scanning 
instance the ones of the resources classified as lower priority are not scanned. 

53. (currently amended) A method comprising the steps of: 

updating, at successive update times, virus definitions for resources stored on a 
data processing system; 

scanning the resources for viruses in first and second scanning instances 
responsive to the virus definitions updated at respective first and second ones of the 
update times; 

computing hash values for the resources at the first and second update times; 

classifying each of the resources as higher or lower priority responsive to whether 
the hash values for each resource are equal for the first and second update times and 
whether the scanning determines each resource is virus free in both the first and second 
scanning instances; 

determining a scanning interval from a time of the first scanning instance until a 

time of the second scanning instance: 
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updating the virus definitions at a next update time; and 

scanning the resources for viruses in a next scanning instance responsive to the 
virus definitions updated at the next time, wherein in the next scanning instance the ones 
of the resources classified as higher priority are scanned before the ones of the resources 
classified a3 lower priorit y and the scanning of the higher priority resources in the next 
instance includes scanning 0 resources determined to be virus free in both the first 
scanning instance and the second scanning instance but not having equal hash values in 
the first and second update times, if) resources determined to be virus free in both the first 
scanning instance and the second scanning instance but wherein the scanning interval is 
less than a predetermined threshold, iii) resources determined to be virus free in the first 
scanning instance and having equal hash values in the first and second update times but 
wherein the scanning interval is less than a predetermined threshold, and iv) resources 
determined to be virus free in the second scanning instance and having equal hash values 
in the first and second update times but wherein the scanning interval is less than a 
predetermined threshold . 

54. (previously presented) The method of claim 53, wherein the data processing 
system has activity intervals of higher and lower activity and in the next scanning instance 
the scanning of the ones of the resources classified as lower priority is performed during 
one of the lower activity intervals. 

55. (canceled) 
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56. (previously presented) The method of claim 53, wherein in the next scanning 
instance the ones of the resources classified as lower priority are not scanned. 

57. (currently amended) A computer program product including stored on a tangible, 
computer readable medium, said computer readable medium p rogram product h aving 
instructions stored thereon for execution by a computer system, wherein the instructions, 
when executed by the computer system, cause the computer system to implement a 
method comprising the steps of: 

updating, at successive update times, virus definitions for resources stored on a 
data processing system; 

scanning the resources for viruses in first and second scanning instances 
responsive to the virus definitions updated at respective first and second ones of the 
update times; 

computing hash values for the resources at the first and second update times; 

classifying each of the resources as higher or lower priority responsive to whether 
the hash values for each resource are equal for the first and second update times and 
whether the scanning determines each resource is virus free in both the first and second 
scanning instances; 

determining a scanning interval from a time of the first scanning instance until a 

time of the second scanning instance: 
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updating the virus definitions at a next update time; and 

scanning the resources for viruses in a next scanning instance responsive to the 
virus definitions updated at the next time, wherein in the next scanning instance the ones 
of the resources classified as higher priority are scanned before the ones of the resources 
classified as lower priorit y and the scanning of the higher priority resources in the next 
instance includes scanning i) resources determined to be virus free in both the first 
scanning instance and the second scanning instance but not having equal hash values in 
I the first and second update times, ii) resources determined to be virus free in both the first 
I scanning instance and the second scanning instance but wherein the scanning interval is 
less than a predetermined threshold, hi) resources determined to be virus free in the first 
scanning instance and having equal hash values in the first and second update times but 
wherein the scanning interval is less than a predetermined threshold, and iv) resources 
determined to be virus free in the second scanning instance and having equal hash values 
in the first and second update times but wherein the scanning interval is less than a 
; predetermined threshold . 

58. (previously presented) The computer program product of claim 57, wherein the 
data processing system has activity intervals of higher and lower activity and in the next 
scanning instance the scanning of the ones of the resources classified as lower priority is 
performed during one of the lower activity intervals. 

59. (canceled) 
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60. (previously presented) The computer program product of claim 57, wherein in 
the next scanning instance the ones of the resources classified as lower priority are not 
scanned. 
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